AML transaction monitoring.

AML transaction monitoring is the process of reviewing customer transactions, by system, by hand or both, to find activity that may be suspicious. The FFIEC's BSA/AML examination manual calls suspicious activity monitoring and reporting “critical internal controls.”⁠[2] This guide covers finding the activity; the alert-to-decision work is in SAR investigations, and the report itself in SAR filing.

Is transaction monitoring required by law?

Not by that name, but in practice yes. The AML program rule requires “ongoing monitoring to identify and report suspicious transactions,” and the SAR rule requires banks and credit unions to report suspicious transactions of $5,000 or more.⁠[3]⁠[4] How you monitor is a risk-based choice: the agencies say the extent and parameters of monitoring should be commensurate with your institution's money laundering and terrorist financing risk.⁠[5]

How is AML monitoring different from fraud monitoring?

Fraud monitoring usually tries to stop a loss before the money leaves. AML monitoring looks across days, accounts and counterparties for patterns of laundering or other crime, usually after the transactions post. The FFIEC manual says banks that split the work between BSA and fraud teams must keep the lines of communication open.⁠[2]

Banks and credit unions file more suspicious activity reports than any other kind of institution.

• 4.3 million to 4.8 million: suspicious activity reports filed by all kinds of institutions rose in each fiscal year from 2022 to 2025.⁠[1]
• 21.5 million currency transaction reports (CTRs) were filed in fiscal 2025, the reports structuring tries to avoid.⁠[1]
• 90–95% of alerts from rule-based monitoring are false positives, by a widely repeated industry estimate that the Bank for International Settlements cites from an Oracle white paper. It isn't a regulator's measurement.⁠[7]

A SAR counts a report, not a loss. One SAR can list several activity types. FinCEN's Year in Review (fiscal years, ending September 30) and its SAR Stats tables (calendar years) count filings differently, so their totals don't line up.

Most monitoring runs the same loop.

1. 1Set the risk baseline. Your risk assessment decides which products, customers and places need the closest watch. Customer due diligence gives each customer a risk profile and an expected pattern of activity.⁠[3]
2. 2Run the rules. Scenarios scan transactions for patterns. The FFIEC manual's sample cash filters include cash transactions between $7,000 and $10,000, and smaller amounts, such as $3,000, that add up to $30,000 over 15 days.⁠[2]
3. 3Raise alerts. Rule-based systems apply fixed filters; adaptive systems compare a customer with its own history or a peer group.⁠[2]
4. 4Review and decide. An analyst checks the alert against the customer's file, closes what's explained and escalates what isn't.
5. 5Tune. Results feed back into the rules: thresholds are tested, gaps closed and every change documented.

Manual or automated monitoring?

Either can work if it fits your risk. Manual monitoring means your team reviews system reports, such as currency activity and funds transfers. The FFIEC manual says banks that are large, operate in many locations or have many higher-risk customers typically automate.⁠[2]

Transaction monitoring looks for typologies: known patterns of laundering and other financial crime. Your risk assessment decides which ones your scenarios cover.

Which signals are growing? On depository SARs, elder financial exploitation stands out.

Red flags

• Cash deposits kept just under $10,000, or split across days, branches or people
• A customer who asks how to avoid a CTR, or changes a cash transaction once told one is needed
• A new account receiving transfers from many unrelated senders
• An older customer suddenly moving savings, buying crypto, or adding a joint owner or agent
• Transfers to digital-asset platforms after a new online relationship or investment offer
• Activity that doesn't fit the customer's stated occupation, business or expected volume

The BSA's rules require ongoing, risk-based monitoring and set the clocks for SARs and CTRs.

Ongoing monitoringOngoing risk-based

A bank's AML program needs risk-based customer due diligence: a risk profile for each customer, and ongoing monitoring to identify and report suspicious transactions. The program's other pillars are covered in BSA compliance.

31 CFR 1020.210(a)(2) · 12 CFR 748.2 (credit unions)⁠[3]

The SAR deadline30 calendar days from initial detection

A SAR is due no later than 30 calendar days after the bank first detects facts that may support one, or up to 60 if no suspect has been identified. An alert isn't initial detection: under the FFIEC manual, the clock starts once an appropriate review determines the activity is suspicious, and that review should be completed in a reasonable period of time.

31 CFR 1020.320(b)(3)⁠[4]⁠[2]

Currency transaction reports15 days after the transaction

A bank files a CTR for each transaction in currency of more than $10,000. Multiple cash transactions by or for one person count as one when the bank knows they total more than $10,000 in a business day, counting cash in and cash out separately. Copies are kept for five years.

31 CFR 1010.311, 1010.313(b), 1010.306(a)⁠[13]

Tuning means adjusting scenarios and thresholds so alerts follow real risk. Done well, it cuts false positives without opening gaps. The FFIEC manual expects management to “document and be able to explain” its filtering criteria and thresholds, and to review and test them periodically.⁠[2]

• Set expectations by account type. Filtering criteria should reflect what's reasonable and expected for each type of account. A customer's own history can mislead when it doesn't match similar accounts.⁠[2]
• Test above and below the line. Sample alerts just over each threshold and activity just under it. The manual warns that a structuring filter triggered only by cash over $10,000 misses the common pattern of deposits slightly under it.⁠[2]
• Rethink rules that only measure proximity to $10,000. Since October 2025 the agencies have said a transaction near the CTR threshold isn't, by itself, enough to require a SAR, and that this doesn't limit appropriately tailored automated monitoring. Before filing, look for signs of evasion, not just amounts.⁠[5]
• Tune for risk, not headcount. The manual is explicit: the volume of alerts and investigations “should not be tailored solely to meet existing staffing levels.”⁠[14]

Is a transaction monitoring system a model?

Often not, under the model risk guidance the OCC, Federal Reserve and FDIC issued on April 17, 2026. It defines a model as a “complex quantitative method, system, or approach that applies statistical, economic, or financial theories,” and excludes “deterministic rule-based processes” with no such theory behind them.⁠[15] By that test, a library of fixed rules and thresholds is generally not a model; statistical or machine-learning scoring generally is. Model or not, the FFIEC manual still expects a monitoring system's programming and effectiveness to be independently validated.⁠[2]

How often should monitoring be validated?

No regulation sets a schedule. For the community banks it supervises, those with up to $30 billion in assets, the OCC said in October 2025 that its guidance does not “require community banks to perform annual model validation.”⁠[16] Validate when your products, customers or typologies change, and keep the evidence for your examiners.

Examiners test whether your monitoring fits your risk, covers your activity and leads to timely, supported decisions. The FFIEC procedures tell them to “follow an alert through the entire process.”⁠[14]

• Coverage: which customers, products and services the system covers, and whether it captures every area of money laundering or terrorist financing risk.
• Filtering criteria: whether thresholds are reasonable, the programming was independently validated, and who can change the assumptions.
• Alert management: whether alerts are reviewed and answered on time, researched properly and adequately staffed.
• Decisions: whether SAR decisions use all the due diligence information and are supported, reasonable and timely.
• Transaction testing: whether your system caught the unusual activity examiners find in sampled accounts, and if not, whether filters, the risk assessment or decision-making is the cause.⁠[14]

The manual's SAR section is being updated for the October 2025 FAQs, which say there is no requirement to document a decision not to file.⁠[5]

Coverage gaps can end in enforcement. According to the Justice Department, TD Bank added no new monitoring scenarios from 2014 through 2022 and kept all domestic ACH, most check activity and other transaction types out of its automated monitoring. That left 92% of its transaction volume, about $18.3 trillion, unmonitored from January 2018 to April 2024.⁠[17]

What would FinCEN's 2026 proposal change?

FinCEN's re-proposed AML/CFT program rule, published April 10, 2026, withdraws and replaces its 2024 proposal. It would direct more attention and resources to higher-risk customers and activities “rather than toward lower-risk customers and activities.” It also names monitoring for “potentially material backlogs” as one way a bank can learn its program isn't being implemented, and a bank that doesn't act on such warnings risks a significant supervisory or enforcement action. As of October 2026 it had not been finalized.⁠[18]

Why alert reviews take so long

Deciding is rarely the slow part. Gathering is: the evidence for one alert sits in seven systems. When every alert takes that long, either the queue grows or the thresholds creep up, and examiners look for both.

Socratix AI coworkers can take on the gathering. For every alert, they can pull the evidence from each system into one case, compare the activity with the customer's profile and the typologies you monitor for, and hand your analysts a recommendation with the reasoning laid out. Your team still makes every call. It can stop spending the day assembling the picture.

Financial crime is moving fast: FinCEN received about 11% more reports of suspected digital-asset investment scams each month than the month before, on average, from September 2023 through 2025.⁠[12] Your team can't add analysts that fast. AI coworkers can do the gathering, every alert, around the clock, so the people you have can spend their time on the decision. FinCEN's 2026 proposal says institutions that responsibly experiment with innovative technologies “will not incur any additional risk” of a significant supervisory or enforcement action solely for using them.⁠[18]

1. GatherCan pull the customer's due diligence profile, transactions and counterparties, cash and CTR history, prior alerts and SARs, and screening results into one case.
2. AssessCan compare the activity with the customer's profile, peer groups and the typologies you monitor for, and watch the SAR clock.
3. RecommendCan recommend closing with a written rationale, opening a case or filing a SAR, with the evidence, a plain-language reason and a draft SAR narrative when one is warranted. Your analyst decides.
4. LearnCan learn from each disposition — your policies, your risk appetite, your analysts' judgment — and log every step for the examiner.

Related guides

• SAR investigations From alert to case to decision: how a suspicious activity investigation runs.
• SAR filing Deadlines, the narrative, continuing activity and confidentiality for suspicious activity reports.
• BSA compliance The Bank Secrecy Act program: pillars, reports, records and the 2026 rule changes.
• Compliance operations What compliance costs a community bank or credit union, and where the hours go.